What you describe is not dissimilar to what I just said. However:
First identify your 'unluckiest' participants.
Step one biggest problem already. Your miners need to have had more than 1 diff's change worth of shares to even begin calling them unlucky. So they need to submit 8 billion diff1 equivalent shares. The miners would need to be hundreds of terrahash before you even accumulate any significant data to even make this call, and then if they split their mining into multiple workers, you will never get 8billion shares like I said.
This is true. But wouldn't hundreds of users coming from the same IP block raise it's own set of flags? I would expect that existing DDOS defenses would ban somebody trying that approach right away.
A pool might have a few IPs like that due to hosting providers but a few phone calls would validate those.